Identifying a breach that resulted in misappropriated data or a breach location of the misappropriated data includes capturing large amounts of data for various interactions. Investigating the large amounts of data may be difficult because all of the various inputs that are available to use in order to determine the potential breach that resulted in misappropriated data. Improved systems are needed in order to provide more accurate identification of a breach that resulted in misappropriated data and/or the location of such breach.